Over more than 40 years reviewing programs, I have found it helps to sort gaps into three buckets:

• Uninsured: A whole category of risk has no policy behind it at all. Cyber and flood are the classic examples, because a standard property or liability policy simply does not respond.
• Underinsured: You have the coverage, but the limit will not fund the loss. A 100,000 dollar cyber sublimit is nowhere near enough to cover a real ransomware or wire fraud event.
• Under-structured: The policy exists and the limit looks fine, but a sublimit, exclusion, coinsurance clause, or named-insured error quietly guts it at claim time.

The cost of leaving these alone is not theoretical. Nine out of ten insurance programs we review contain at least one fatal flaw, and the price of a single one runs into six figures fast.

Roughly 60 percent of small and mid-sized businesses fail following a cyber event, and one client saw a 400,000 dollar wire fraud claim denied outright because the business failed to follow the authentication steps buried in the policy.

A gap is not a paperwork problem. It is a survival problem, and naming yours is the first step to closing it.

If you want a second set of eyes, start with a conversation.

Why do coverage gaps happen if I already have insurance?

Most commercial insurance coverage gaps happen because the business changed and the policy did not. You added locations, revenue, payroll, equipment, vehicles, or contracts, and the program kept renewing on autopilot as if nothing moved. The trap is that renewal feels like a checkup when it is really just a copy-and-paste, and that quiet drift is exactly where exposure builds.

From what I have seen, the renewal process is the single biggest source of hidden gaps.

Nobody did anything wrong; the policy just stopped matching the company.

The same patterns show up again and again:

• Values fall behind. Building, equipment, and inventory stay listed at old numbers while replacement costs climb, which sets up a coinsurance penalty at claim time.
• New activities go uninsured. A new product line, service, entity, or state footprint creates risk the old policy never contemplated.
• Contracts move faster than coverage. A client, landlord, or lender adds an insurance requirement, and the policy no longer satisfies it.

Bottom line is that almost all insurance programs we review contain at least one fatal mistake.

That is why what your broker reviews at renewal matters so much, and why gaps are so predictable once you know where to look.

A real review compares the policy against the business as it exists today, not as it existed three renewals ago.

If your last renewal was a five-minute signature, that is a signal worth taking seriously. See what a real renewal review should cover.

The 9 most common commercial insurance coverage gaps

The most common commercial insurance coverage gaps cluster around nine exposures: cyber, business interruption, supply chain, property valuation, flood and earthquake, equipment breakdown, employment practices, management liability, and non-owned auto. What ties them together is one pattern: each looks covered on the surface, and each has a reason it quietly is not. Here is the full map.

This is the gap I lose the most sleep over, because it is both the most common and the most misunderstood.

Most owners assume a general liability or property policy will respond to a breach or a wire fraud.

It will not.

According to the Insurance Information Institute, most traditional commercial general liability policies do not cover cyber risks, which leaves the exposure entirely uninsured unless you buy a dedicated policy.

Even owners who buy cyber often buy too little.

The ransom alone swallows a 100,000 dollar sublimit, before you touch forensics, legal, notification, and lost revenue.

The stakes keep rising, too: the Allianz Risk Barometer ranks cyber as the number one global business risk for 2026 at 42% of responses, and the III reports that half of US small and mid-sized businesses suffered a data breach in the past year.

If you carry cyber at all, confirm the real limits and the social-engineering coverage inside your cyber insurance before you need them.

Business interruption coverage exists to replace lost income when a covered event shuts you down, and it is one of the most frequently underbuilt lines on the page.

The catch is in the fine print: the income period, the payroll treatment, and the indemnity period all have to match how long a real recovery takes.

Owners tell me the same painful story, that neither policy compensated them for the months they sat closed.

To pressure-test this line, review:

• The recovery period. Rebuilding and reopening often takes 12 to 24 months, not the few months a default worksheet assumes.
• Payroll treatment. Decide whether you need to keep paying key staff through a shutdown, and confirm the policy funds it.
• Civil authority and utility coverage. A shutdown ordered by authorities or caused by a utility failure needs its own trigger.

Supply-chain gaps show up when a supplier or customer fails and your own property is never touched.

Ordinary business interruption requires direct physical loss at your location, so a vendor’s fire or a key customer’s shutdown can wipe out your revenue while your policy stays silent.

That is the exposure contingent business interruption is built to close.

In practice, this gap hits hardest for manufacturers, distributors, and any business built on a small number of critical suppliers.

Review whether your program includes contingent business interruption coverage, whether suppliers are named or unnamed, and how the sublimits and waiting periods are set.

A single dependent supplier can carry more of your revenue than any one piece of equipment.

Talk through your supply-chain exposure.

Property underinsurance happens when your building, equipment, and inventory are insured for less than it costs to replace them today.

Here is the twist that catches owners off guard: the insurer can penalize you even on a partial loss.

If your values are too low, a coinsurance clause reduces what the insurer pays, so a covered claim still leaves you writing a large check.

From what we see in practice, this is the quietest gap of all, because the policy looks complete right up until the adjuster applies the math.

Confirm your statement of values reflects current replacement costs, ask whether you carry agreed value (a preset value the insurer won’t second-guess at claim time) or inflation guard (an automatic bump to keep pace with rising costs), and check for ordinance-or-law coverage (which pays the extra cost of rebuilding to current code) on older buildings.

This is the same exposure that makes so many owners quietly underinsured without knowing it.

Virtually every standard commercial property policy excludes flood and earthquake, which makes them pure uninsured gaps unless you add separate coverage.

Many owners assume “property insurance” means all property perils.

It does not, and the geography of risk is wider than most people think.

FEMA notes that properties well outside mapped high-risk zones still flood.

The scale of the shortfall is striking.

Industry research cited by the III estimates that, on average, roughly 86% of flood losses and 90% of earthquake losses go uninsured.

If your business sits on a ground floor, holds inventory low, or depends on a single location, review a separate flood policy through the National Flood Insurance Program or a private market, plus earthquake coverage where the exposure warrants it.

Equipment breakdown covers the internal mechanical and electrical failures that standard property policies restrict or exclude.

Owners often assume a property policy covers anything that breaks.

In reality, a fire is covered while a fried compressor or a failed electrical panel may not be, and the resulting spoilage and downtime stack up fast.

This gap matters most for businesses that run on refrigeration, production equipment, HVAC, or specialized machinery.

Review whether your program includes equipment breakdown coverage, whether it extends to spoilage of perishable stock, and whether it replaces lost income during the repair.

The machine that runs your revenue deserves its own protection, not an assumption.

Employment practices liability covers claims your general liability policy specifically excludes: harassment, discrimination, retaliation, and wrongful termination.

Most owners are stunned to learn their liability policy does nothing here, and the exposure grows with every hire.

This is one of the fastest-rising claim types we deal with.

The numbers make the case.

In any given year, US companies face roughly a 1-in-10 chance of an employment charge being filed against them, according to Hiscox, odds that stack up fast across the life of a business.

I have watched a client spend 140,000 dollars defending a single claim out of pocket because they had no EPLI.

Once you pass roughly 25 employees, this coverage stops being optional.

Review your EPLI limit, whether it includes third-party coverage for customer claims, and any wage-and-hour defense sublimit.

Contact us to check your EPLI exposure.

Hired and non-owned auto covers the vehicles your business uses but does not own, from employees’ personal cars run on errands to rented trucks.

Owners assume that because they do not own a fleet, they carry no auto exposure.

The opposite is true: the moment an employee drives their own car for work, that claim can pull your business in.

This gap is simple to close and easy to overlook.

If anyone drives a personal or rented vehicle for business purposes, even occasionally, confirm that you carry a hired and non-owned auto endorsement.

It is one of the least expensive fixes on this list and one of the most commonly missing.

That covers the nine, so the next question is how to find which of them are hiding in your own policy.

Book a call and we will map yours.

Professional liability and directors and officers coverage protect against financial and management risks that general liability was never built to cover.

General liability answers for bodily injury and property damage, not a client’s pure financial loss from your advice or a lawsuit over a leadership decision.

That boundary is where a lot of businesses fall through.

If you give advice, deliver a professional service, sit on a board, or make decisions that affect employees, investors, or creditors, you likely need errors and omissions or directors and officers coverage.

Without it, a single management-liability lawsuit can reach the personal assets of the owners and officers named in it.

Review whether these lines exist in your program and whether the wording matches what your company actually does.

There is a structural trap here that catches even careful owners: unlike your general liability policy, E&O and D&O are almost always written on a claims-made basis, not occurrence.

That means the policy in force when a claim is filed is the one that responds, not the policy that was active when the mistake happened.

Switch carriers or let coverage lapse without carrying your retroactive date forward, and a mistake from years ago can come back to a policy with nothing behind it.

Confirm the retro date every time this coverage renews or changes carriers, not just the limit.

How do I identify the gaps in my own policy?

You identify commercial insurance coverage gaps by comparing your business as it operates today against your policy’s exclusions, sublimits, and limits, line by line. The most useful move is deceptively simple: read the declarations page and the exclusions with your actual operations in mind, not the insurance language in the abstract. That is where the mismatches surface.

Over the years I have found the fastest way to spot a gap is to ask operational questions, then trace each one back to the policy:

• Has the business added services, equipment, locations, or vehicles in the past year?
• Could we keep operating, and keep paying people, if we shut down for a month?
• Are our tools and equipment covered when they leave the property?
• Do we actually understand what the policy does not cover?
• Has anyone reviewed this coverage with us in plain terms recently?

Each “no” or “not sure” points at a likely gap.

The frequency of these reviews matters as much as the depth, which is why we recommend a real look at least annually and after any major change.

Here is how often you should review your business insurance and what a genuine review includes.

Your commercial coverage-gap self-audit checklist

This checklist turns the nine gaps into a quick self-audit you can run to surface commercial insurance coverage gaps in about fifteen minutes. Work through it with your declarations page open, and treat every box you cannot confidently check as a gap to raise with your broker. It will not replace a professional review, but it tells you fast where you stand.

If more than one box gives you pause, you are in normal company, and it is worth a professional review.

What your general liability and BOP do NOT cover

Your general liability policy and business owner’s policy cover a narrow slice of risk, and the gaps live in everything they leave out. Most owners assume a BOP is an all-in-one shield. It is a solid foundation, but it was never built to answer for cyber, employment, professional, flood, or management exposures. That boundary is where the missing pieces hide.

The takeaway is not that a BOP is weak.

It is that a BOP is a starting point, and closing your commercial insurance coverage gaps means layering the right coverage lines on top to match your real operations.

Mapping that layering is exactly what a specialist does.

What drives the cost of closing a gap

Closing a gap does not mean buying every coverage at the highest limit on the menu. Premium moves with a handful of concrete factors, and knowing them is what separates a real fix from an unnecessary upsell.

The right move is rarely “buy more.”

It is matching each limit to what a realistic loss would actually cost you, then closing the specific sublimits, exclusions, and structural gaps that would otherwise undercut a policy that looks complete on paper.

What to do when you find a gap

When you find a gap, the goal is not to panic-buy every policy on the menu; it is to close the exposures that would actually threaten the business first. The smartest owners turn a gap review into leverage, walking into the broker conversation able to tell a meaningful coverage improvement from a generic upsell. That shift, from guessing to knowing, is the whole point.

In practice, closing gaps well comes down to a few disciplined moves:

• Prioritize by severity. Fund the losses that could end the business, cyber, business income, and management liability, before the smaller stuff.
• Right-size limits, not just presence. A policy that exists but cannot fund the loss is still a gap. Match limits to real exposure.
• Fix the structure. Sublimits, coinsurance clauses, and named-insured errors deserve as much attention as missing policies.
• Align coverage to contracts. Make sure the program satisfies every current client, lease, and lender requirement.

The right partner should be doing this with you, not selling around it.

A generalist can quote your general liability in an afternoon; closing gaps like these usually means placing coverage with carriers who actually underwrite the niche risk in front of them, negotiating sublimits instead of accepting the first number offered, and tracking a retro date across multiple renewals so old exposure never falls through the cracks.

If you are not sure yours is doing that, here is what your insurance broker should actually be doing on your behalf.

Quick answers and buying considerations